glib-web 5.1.2 → 5.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8e7848fb02064447620d8fca19a5f94b27c135b5e6c40dcd3c16974d19bb84e7
-  data.tar.gz: e187535507305543f7c5c9a5734393d60c89fd1167bf488489963b304dd92f44
+  metadata.gz: 54f283b08cba85e7935323705254ff4c53831314f87a71661f11761d4be37544
+  data.tar.gz: df856aaa88383c8e54384d8d0a6ed81536f5457efc0b523d1cf5dba0ef558a9b
 SHA512:
-  metadata.gz: 555954cb635653ad23d9af3da7810db47bf87b4ad6807d029a5294fcb1212eee02cefa64f96a97e819c11d1a5ed3134855329e722e18207df20c0f0153011e8e
-  data.tar.gz: fde96a7c67e9f8e718d0cb7c8de72dd882e49607965891040fadf6c5b71e20be4ef2f3f69cb810662d585434ad1e650174569c0ddc87959c601fd10cdeadb189
+  metadata.gz: d4011507ec92ac5666c5af93ef6b7cca59444fdae226b20a805a2582e1710138b9839ed0f430ca585b7fb3f2120d1d541a0120c61655347defa7b90344d631eb
+  data.tar.gz: 548c0fcd1edb93c05f846acf93114b818127ccb5e3e5c8f1c65dad2c195ba8e9b66ca12d2aef37344c622d321ad9b799d1794bcc9314f7f524db7840194f6ecf

data/app/controllers/concerns/glib/auth/policy.rb

@@ -101,7 +101,16 @@ module Glib::Auth
         end
       end
 
-      resource_instance = instance_variable_get("@#{resource_name}") || options[:resource] || policy_name
+      resource_instance = instance_variable_get("@#{resource_name}")
+      if resource_instance.nil?
+        # An explicitly supplied `resource:` is authoritative even when nil (e.g. a scoped
+        # `find_by` that resolved nothing). Falling back to the policy-name symbol would hand
+        # the policy a truthy placeholder in place of the missing record, so record-bound gates
+        # (`record.present?`, `return false unless record`) would pass for exactly the request
+        # they exist to refuse -- fail-open. Pass the nil through so they fail closed. The
+        # symbol fallback remains for callers that don't supply `resource:` at all.
+        resource_instance = options.key?(:resource) ? options[:resource] : policy_name
+      end
 
       query = "#{action_name}?"
       policy_instance = policy(resource_instance, policy_name, options.fetch(:context, nil))

data/app/controllers/concerns/glib/params/allowlist.rb

@@ -16,8 +16,14 @@ module Glib::Params
     # nil / "" fall through to +default+ implicitly (no symbol's string form is
     # blank). Use it for any closed-vocabulary boundary input: interval
     # selectors, status filters, UTM tags, feature-flag names.
+    #
+    # +allowed_symbols+ may also contain strings (e.g. a Rails enum's `.keys`)
+    # — the matched entry is symbolized on the way out, so the return value is
+    # ALWAYS a symbol (or +default+). That `to_sym` runs only on the
+    # developer-controlled list entry, never on +value+, so the DoS-safety
+    # above is unaffected.
     def glib_allowlist_symbol_param(value, allowed_symbols, default:)
-      allowed_symbols.find { |symbol| symbol.to_s == value.to_s } || default
+      allowed_symbols.find { |symbol| symbol.to_s == value.to_s }&.to_sym || default
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: glib-web
 version: !ruby/object:Gem::Version
-  version: 5.1.2
+  version: 5.1.3
 platform: ruby
 authors:
 - ''